AZ-500 Practice Test 4 — 10 Questions

Question 1

An organization has deployed Microsoft Sentinel as their SIEM. They need to ingest audit logs from their Amazon Web Services (AWS) environment, including CloudTrail logs. Which data connector should they use in Microsoft Sentinel to collect these logs?

Accepted Answer

Amazon Web Services connector. The Amazon Web Services connector is the correct data connector in Microsoft Sentinel for ingesting AWS audit logs, including CloudTrail logs. It establishes a connection to AWS by requiring a role ARN and external ID, enabling Sentinel to pull CloudTrail events via the AWS API. This connector specifically supports CloudTrail management and data events, making it the appropriate choice for audit log ingestion.

Answer

AWS S3 connector

Answer

Azure Sentinel to AWS connector

Answer

CloudTrail connector

Question 2

A security engineer needs to collect custom application logs from Azure VMs using Azure Monitor Agent for Sentinel analysis. Which two components are required?

Accepted Answer

A Data Collection Rule that defines the custom log collection. A Data Collection Rule (DCR) is required to define the schema, transformation, and destination for custom log data ingested by Azure Monitor Agent. Without a DCR, the agent has no configuration for which custom logs to collect or how to process them.

Answer

A storage account configured for static website hosting

Answer

A Conditional Access policy requiring MFA

Question 3

A security administrator is troubleshooting network connectivity to an Azure virtual machine. The VM is behind a network security group (NSG) that has a deny-all inbound rule as the default. The administrator wants to quickly verify whether a specific TCP packet on port 3389 from their client IP (203.0.113.50) would be allowed or blocked by the NSG. Which Azure Network Watcher tool should they use?

Accepted Answer

IP flow verify.. IP flow verify is the correct tool because it tests whether a specific packet (source IP, destination IP, protocol, port) is allowed or denied by an NSG or virtual network (VNet) route. In this scenario, the administrator needs to quickly validate inbound TCP traffic on port 3389 from client IP 203.0.113.50 to the VM, and IP flow verify provides a pass/fail result along with the exact rule that caused the outcome.

Answer

Network Performance Monitor.

Answer

Next hop.

Answer

NSG diagnostics (flow logs).

Question 4

A security operations team uses Microsoft Sentinel. They want to enable User and Entity Behavior Analytics (UEBA) to detect anomalous user activities. Which configuration is required?

Accepted Answer

Enable UEBA in the Sentinel settings. UEBA in Microsoft Sentinel is a built-in feature that must be explicitly enabled in the Sentinel configuration settings under 'Entity behavior analytics'. It does not require a separate data connector or analytics rule template; once enabled, Sentinel automatically ingests and analyzes existing log data (e.g., Azure AD sign-ins, Office 365 audit logs) to establish behavioral baselines and detect anomalies.

Answer

Install the UEBA data connector

Answer

Create an analytics rule with UEBA template

Answer

Assign the Security Reader role to Sentinel

Question 5

A security team uses Microsoft Defender for Cloud to centralize security alerts. They want to continuously export all security alerts to a Log Analytics workspace for long-term retention and custom analysis. Which two actions must be taken to achieve this? (Choose two that apply.)

Accepted Answer

Enable the continuous export feature in Microsoft Defender for Cloud.. Option A is correct because Microsoft Defender for Cloud's continuous export feature allows you to stream security alerts and recommendations to a Log Analytics workspace or Event Hubs at the subscription or tenant level. This feature is designed specifically for ongoing export, supporting long-term retention and custom analysis without manual intervention.

Answer

Create a Log Analytics workspace in the same region as the resources.

Answer

Assign an Azure Policy definition for 'Deploy export to Log Analytics workspace for Azure Security Center data'.

Question 6

A security team uses Microsoft Defender for Cloud to monitor Azure virtual machines. They want to automatically install a specific endpoint protection solution on all Windows VMs that are currently missing it, without manual intervention. The solution is not integrated natively with Defender for Cloud. Which feature should they use?

Accepted Answer

Create an Azure Policy 'DeployIfNotExists' assignment that installs the endpoint protection extension on VMs missing it. Option B is correct because Azure Policy's 'DeployIfNotExists' effect can automatically deploy a custom endpoint protection extension to Windows VMs that are missing it, even if the solution is not natively integrated with Defender for Cloud. This allows the security team to enforce compliance by installing the specific third-party endpoint protection agent via a policy assignment, without manual intervention.

Answer

Enable the 'Endpoint protection' recommendation and use the 'Fix' option

Answer

Configure adaptive application controls to allow the endpoint protection software

Answer

Enable just-in-time VM access for the VMs

Question 7

A company wants to identify excessive permissions across Azure, AWS, and GCP identities. Which Microsoft security capability is designed for cloud infrastructure entitlement management?

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions assigned to identities across multi-cloud environments (Azure, AWS, GCP). It helps detect and remediate excessive, unused, or risky permissions by analyzing identity activity and entitlement data, enabling least-privilege access control.

Answer

Azure Monitor metrics

Answer

Microsoft Purview eDiscovery

Answer

Azure Front Door WAF

Question 8

A hub-and-spoke Azure network uses Azure Firewall for egress inspection. Which two settings are typically required on spoke workloads?

Accepted Answer

UDRs that send default traffic to the firewall next hop. In a hub-and-spoke topology with Azure Firewall for egress inspection, spoke workloads must not be able to bypass the firewall. A User Defined Route (UDR) with address prefix 0.0.0.0/0 and next hop type VirtualAppliance pointing to the firewall's private IP forces all outbound traffic through the firewall. Additionally, DNS and routing design must prevent direct internet access—for example, by using Azure Private DNS zones or custom DNS servers that resolve only internal names, ensuring that no traffic can exit the spoke without firewall inspection.

Answer

Public IP addresses on every VM

Answer

NSG rules that allow all inbound internet traffic

Question 9

A security analyst uses Microsoft Sentinel. They want to create a rule that triggers an incident when a user is added to a highly privileged Azure AD role (e.g., Global Administrator). The data source is Azure AD audit logs. Which type of analytics rule should they create?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because Azure AD audit logs are historical data ingested into Log Analytics, and scheduled queries run on a defined interval (e.g., every 5 minutes) to detect patterns like role assignments. This rule type allows you to write a KQL query against the AuditLogs table to identify when a user is added to a highly privileged role, then map the results to an incident. NRT rules are designed for high-frequency, low-latency scenarios but do not support Azure AD audit logs as a source; they require a dedicated table with near-real-time streaming.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Microsoft Security incident creation rule

Question 10

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment (VA) solution that continuously scans Azure VMs for vulnerabilities and provides security alerts when critical vulnerabilities are found. Plan 1 only offers basic threat detection and does not include the integrated VA scanner or the ability to generate alerts based on VA findings.

Answer

Defender for Servers Plan 1

Answer

Defender for Cloud Apps

Answer

Defender for Storage